Typosquatting attacks

This report examines malicious packages in public registries with emphasis on typosquatting, using the npm 'crossenv' incident as a case study: the package used a postinstall script to base64-encode and POST environment variables to an attacker-controlled server while still providing the expected functionality to avoid detection. The document outlines how such packages are published, the risks to development workflows and CI/CD environments, and recommended mitigations (e.g., avoid sensitive data in env vars, use --ignore-scripts, consult package health tools, and use dependency monitoring).